linux-kernel - Re: SNATed connections show as original ip in /proc/net/tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 11 Jul 2010 11:11:59 -0400
From:	"Noah McNallie" <n0ah@...h.org>
To:	linux-kernel@...r.kernel.org,
	"Alexander Clouter" <alex@...riz.org.uk>
Subject: Re: SNATed connections show as original ip in /proc/net/tcp

On Sun, 11 Jul 2010 10:30:25 -0400, Alexander Clouter <alex@...riz.org.uk>  
wrote:

> Noah McNallie <n0ah@...h.org> wrote:
>>
>> just as the topic describes.
>>
> Probably better to post this to netdev?
>
>> I'm currently doing SNAT to force some destination tcp ports to be  
>> routed
>> through a specific route rather than the default route. To accomplish  
>> this
>> I mark thoes packets with iptables, use 'ip' to specify marked packets  
>> via
>> the specified route, and then use iptables to change their source  
>> address.
>>
> SNAT'ing locally sourced traffic?  That's pretty nasty.
>
> Look into using 'ip rule' and a second routing table.
>
> http://lartc.org/howto/lartc.rpdb.html
>
> You will still need use iptables/MARK to do L4 (tcp/udp/etc) policy
> routing though, however now you can dump the ugly SNATing.
>
> Cheers
>

ok i'll stick it there i must have missed that browsing mailing lists last  
night... uhh as far as ip rule i am using that, that's how i match the  
packets with the firewall mark that need to go out a specific interface  
and to a specific route... i don't believe ip rule has any option to match  
packets based on destination port and change their source address and  
route them out any specific interface, or i'd be doing that all along as  
that would be much better.

noah
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/